APT 40 Maritime and Defense Sector Intrusions

APT40’s maritime and defense intrusions follow a long-term plan to gather information for PRC naval modernization and South China Sea goals. For defenders, the useful question is not just how APT40 breaks in, but which information it wants and where that information sits.

Why APT40 targets maritime and defense sectors, and why it matters to defenders

Public attribution spans government advisories, criminal charges, and threat research, while differing group labels can make the same operation harder to track as a unit. Despite the differing group labels, the operation shows a consistent interest in maritime research, engineering, and defense information. Tracking that interest gives practitioners a steadier reference point than treating every disclosure as a separate threat.

Mandiant Intelligence assesses APT40’s operations as a cyber counterpart to China’s efforts to modernize its naval capabilities. Its assessment connects university research targeting with the theft of designs for marine equipment and vehicles. A research institution and a marine equipment company may look unrelated on a network diagram, but both can hold knowledge that helps the same naval program. For defenders, that link is a reason to look at the knowledge an organization holds, beyond the broad warning that comes with being in the sector.

The PRC strategic objectives that explain which targets APT40 chooses

PRC naval modernization requires vessel design data, shipbuilding capacity intelligence, undersea research, and visibility into regional maritime logistics. APT40 chooses targets that meet those needs. Its collection also extends to government activities related to South China Sea disputes, where political and operational information complements technical knowledge. The demand explains the shopping list.

Mandiant’s overview describes targeting of government-sponsored projects and the theft of information specific to them, including proposals, meeting records, financial data, shipping information, plans and drawings, and raw data. A drawing explains a design, while the surrounding project records can provide context about its development. Project administration may be dull reading, but intelligence services are not shopping for a beach novel.

The assessed links to the People’s Liberation Army Navy and defense-related research groups tie these requirements to customers who need the information for naval operations. That also explains secondary targets such as aerospace suppliers, advanced manufacturing companies, and academic institutions researching naval strategy and maritime law. The shipyard is only one part of the system. This targeting forms a coherent collection perimeter when understood as an intelligence requirements document expressed through intrusion activity.

How the 2021 DOJ indictment and front company structure revealed the institutional machinery behind the targeting

The July 2021 DOJ indictment named Hainan State Security Department officers Ding Xiaoyang, Cheng Qingmin, and Zhu Yunmin, and Hainan Xiandun employee Wu Shurong. It named Hainan Xiandun Technology Development Co. as the front company that gave the operation cover. This was an organization with administrative machinery. It ran genuine job advertisements and hired translators to process stolen material, showing that collection involved more than gaining access and downloading files.

The indictment described theft of trade secrets, intellectual property, and high-value information from companies in the United States and other countries, as well as foreign governments. The stolen technologies included those used for submersibles and autonomous vehicles, specialty chemical formulas, commercial aircraft servicing, and proprietary genetic-sequencing technology. The maritime connection is especially clear in the first group. The wider portfolio also shows why this operation cannot be understood as a single-purpose shipyard hacking team.

The documented commercial application IP theft in 2015 occurred one month after the Obama-Xi no-theft agreement. That timing exposes the limits of diplomatic assurances as a defensive assumption. When an institution organizes collection around standing requirements, neither a change in personnel nor public exposure necessarily removes the demand. The office can change its nameplate without changing its workload.

What the 2016 maritime R&D contractor breach shows about how APT40 executes once it has a target

The DOJ indictment describes an August 2016 spearphishing email that enabled installation of MURKYTOP and BADFLICK in the same network folder at a maritime research and development contractor. The malware roles deserve a careful distinction. The indictment calls MURKYTOP a lateral movement tool, while MITRE ATT&CK and Mandiant classify it primarily as a reconnaissance tool. BADFLICK provided the backdoor for initial or continued access.

The people targeted worked in engineering, analyst, and purchasing roles. That selection fits the information being sought. People in those roles hold vessel design data, maintenance schedules, and project specifications, so they are close to the technical records the group wants. The case illustrates how collection requirements can shape both the choice of organization and the choice of people inside it, before malware begins its work.

APT40's full intrusion lifecycle, from initial access to exfiltration, and where defenders have genuine detection windows

When exploitation is available, initial access often begins with vulnerable public-facing infrastructure. APT40 conducts continuous reconnaissance for end-of-life or unmaintained devices and has exploited vulnerabilities dating back to 2017. Old weaknesses remain useful entry points. The defensive window therefore starts with exposed infrastructure, and a patching window cannot serve as the primary control. The 2016 case demonstrates one of the access routes used across campaigns.

For credential capture within a persistent intrusion, the ACSC case study in a 2024 Australian cybersecurity advisory documents several hundred username-password pairs captured in clear text on a compromised appliance. Separately, it records captured MFA token values corresponding to legitimate logins. The actor likely modified the genuine authentication process to write these values to a file. This targets the machinery handling credentials, so standard MFA deployment does not by itself address the attack path.

After access, defense evasion reduces the visible malware footprint through legitimate system binaries. A low-and-slow tempo seeks to avoid behavioral detection, while code obfuscation conceals configuration data. Quiet does not mean absent. The detection opportunity is to assess activity within the victim’s environment rather than rely only on recognizable malware, although the deliberate pacing makes that assessment harder.

Command and control uses encrypted HTTPS, hard-coded fallback domains, compromised servers, and commercial VPS providers. Exfiltration then compresses and encrypts emails, documents, engineering data, and credentials before transfer. The theft can proceed in gradual segments. That design undermines volume-based DLP controls, which should not be expected to catch disciplined exfiltration simply because enough data eventually leaves. MITRE ATT&CK mapping can organize these phases, but defenses still need to address each behavior.

Why SOHO device compromise as operational infrastructure changes the defensive calculus

Compromised small-office/home-office devices let APT40 route attack traffic through geographically local, legitimate-looking exit nodes. This infrastructure weakens filtering that relies on IP reputation or country of origin because the visible source can be an ordinary device.

The 2024 joint advisory from Five Eyes agencies and partners, including Germany, Japan, and South Korea, highlighted APT40’s exploitation speed and use of compromised SOHO devices. The group is shifting toward large networks of compromised routers, IoT devices, and end-of-life edge appliances that it keeps refreshing. These devices support reconnaissance, malware delivery, command and control, and exfiltration.

Many devices are unpatched or beyond support, making them cheap to compromise and difficult to remediate. Their owners may be small businesses or home users who lack the means for incident response. That creates an external dependency defenders cannot readily repair. The resulting posture shift is toward behavior-based and anomaly-based detection within the victim’s own network, where activity can be judged against its context rather than the apparent respectability of its return address.

How supply chain and subcontractor networks became the primary soft target in maritime defense

The July 2025 NCDOC/Mandiant disclosure showed how the group got in through the supply chain, using smaller vendors that serve maritime defense. Exfiltrated material included CAD schematics, project timelines, and personnel rosters. These were engineering and operational planning records. Their value follows the same collection logic as vessel designs and research data, while the intrusion path exposes where that information can be reached outside a hardened prime contractor.

APT40 compromises smaller logistics, shipbuilding, and maintenance subcontractors that connect to prime contractor and naval networks. That route can bypass perimeter controls at the organization ultimately of interest. A supplier connection can place a weaker organization on the path to information that a better-resourced organization is trying to protect.

Shipbuilding and repair companies, maritime industries, and defense contractors are the main targets, while academic institutions and think tanks supply those sectors with technical knowledge. Not every node needs to hold the complete design to be useful. The structural imbalance is that a subcontractor serving a naval prime lacks resources to match the adversary, yet its connection can affect the prime’s security.

Why public attribution and indictments have not disrupted APT40's operations

Samoa’s National Computer Emergency Response Team attributed malicious cyber operations against government and critical infrastructure networks in the Pacific to APT40 in 2025. Australian officials also underscored the growing cyber threat to the Pacific. That record points to geographic expansion after years of exposure.

The indictment remains valuable because it reveals people, institutional links, and the processing of stolen information. Attribution has intelligence and policy uses as well. Neither is a substitute for a defensive control.

A strategy premised on exposure stopping the threat leaves protection dependent on a decision outside the organization. Intelligence-led defense instead uses the disclosed requirements and methods to prioritize the information and access paths likely to attract attention.

What understanding APT40's collection logic enables defenders to do differently

Maritime and defense teams can prioritize controls around the data types, network positions, and infrastructure classes APT40 consistently seeks. Vessel designs, engineering records, project information, and the systems that expose them provide a more useful starting point than a generic perimeter exercise. The collection requirement becomes the organizing principle. It connects the reason an organization could be targeted with the access and theft behaviors its defenses need to address.

Credential architecture review takes priority because the ACSC case shows compromise of the authentication process itself. The review must assess whether the process handling credentials and tokens is protected against the documented attack path, even when MFA is enabled. Supplier exposure deserves the same active scrutiny. The July 2025 disclosure makes vendor risk assessment an intelligence question about reachable data and connections, rather than an annual audit that goes back into a drawer.

Security vendors that serve these sectors should make those links clear in their advisory material through analysis of each sector, MITRE ATT&CK mapping, and primary government advisory sources. Specificity is the useful test of expertise. Threat-intelligence-powered content studios such as Cyberou are one option for communicating that connection between collection logic and defensive priorities. The best material helps a practitioner decide what to protect before the next intrusion, as well as recognize the group after it arrives.